Download ARUBAOS™ The operating system designed with data sheet

data sheet
ARUBAOS™
Web Content Policy and Reputation Control
The operating system designed with
scalable performance
essential to identify how users spend their time online. This
Web Content Policy provides the visibility and control that’s
enables IT administrators to reduce or eliminate inappropriate
web traffic from enterprise networks.
ArubaOS is the operating system and application engine for
Web Reputation Control gives IT administrators critical insight
all Aruba Mobility Controllers and controller-managed
into the risks of malware, phishing, and other security
wireless LAN (WLAN) access devices. Designed for scalable
problems associated with Internet usage, and provides the
performance, ArubaOS consists of three core components.
vital tools to block dangerous content.
First, a hardened, multicore, multithreaded supervisory
AirGroup™ technology
kernel manages administration, authentication, logging and
AirGroup makes it easy to share Apple TVs, printers, Google
other system operation functions. This control plane is
Chromecast, and other mDNS-advertised devices across
distinctly separate from the packet forwarding components
subnets. Simple configuration options ensure that all devices
to ensure continuous availability.
can see each other while advanced options reduce the scope
Second, an embedded real-time operating system powers
of sharing based on physical location, time of day, role and
dedicated packet-processing hardware. This highly parallel
self-provisioned sharing islands.
architecture includes support for high-performance deep packet
Adaptive Radio Management™ (ARM) technology
inspection of every connection that traverses the controller, and
ARM™ dynamically optimizes Aruba WLAN access points
implements all routing, switching and firewall functions.
(APs). By ensuring radios stay clear of RF interference and
Third, a programmable encryption/decryption engine built on
dynamically adjust their transmission power, ARM™ creates a
dedicated hardware delivers client-to-core encryption for
more reliable and higher-performing WLAN infrastructure in
wireless user data traffic and software VPN clients.
constantly-changing RF environments.
ArubaOS comes with an extensive set of integrated
Integrated threat protection
technologies and capabilities:
To protect network resources from wireless threats, ArubaOS
ClientMatch™ technology
Patented ClientMatch technology eliminates sticky clients and
boosts Wi-Fi client performance by continuously gathering
integrates the industry’s leading rogue AP containment and
classification solution that can be deployed with or without
dedicated RF sensors.
session performance metrics from mobile devices and using this
For the ultimate in RF security, the ArubaOS RFProtect
information to steer each one to the best WLAN AP and radio.
module integrates wireless security into the network
AppRF™ technology
AppRF technology, part of the optional ArubaOS Policy
Enforcement Firewall™ (PEF) module, brings application
awareness to WLANs. It uses deep packet inspection to identify
infrastructure without requiring a separate system of RF
sensors and security appliances and enables governmentgrade wireless intrusion protection.
RFProtect also includes powerful Spectrum Analyzer
enterprise, cloud and mobile apps.
capabilities, which provide a critical layer of visibility into
It also enables IT to prioritize applications for each user and
WLAN channel quality. It eliminates wireless threats and
scales for BYOD transaction and device density. The PEF™
module also provides critical identity-based controls to
enforce application security and prioritization.
non-802.11 sources of RF interference and their effects on
interference, while optimizing network performance
Advanced cryptography
The ArubaOS Advanced Cryptography (ACR) module
brings military-grade Suite B cryptography to Aruba
Mobility Controllers, enabling user mobility and secure
access to networks that handle sensitive, confidential and
classified information.
data sheet
ARUBAOS™
Approved by the U.S. National Security Agency (NSA), Suite B
Uniform security and access policies are applied to users in
improves performance, eliminates unwieldy workflows and strict
headquarters, branch offices, home offices, and on the road.
handling requirements, allows interoperability, and supports
Users and devices join the network through simple
commercially available mobile devices – all at a fraction of the
lightweight access devices or software, which securely and
cost of previous-generation cryptographic methods.
automatically connect to Mobility Controller.
Virtual Intranet Access™ (VIA) client
Powered by ArubaOS, Mobility Controllers manage Aruba
VIA™ is a free hybrid IPsec/SSL VPN that automatically scans
access devices and access software. They also manage
and selects the best secure connection to the corporate
software images, configurations and user connection states,
network. Unlike traditional VPN software, VIA offers a zero-
and enforce policies.
touch end-user experience and automatically configures
The entire infrastructure – wireless and wired – is controlled
WLAN settings on client devices.
through a single pane of glass by Aruba AirWave™, which lets
VIA is completely Wi-Fi-aware. From a non-corporate network – a
IT manage the application and device experience of users
home Wi-Fi, 3G or public Wi-Fi hotspot – VIA automatically
across several generations of multivendor networks.
launches a VPN-on-demand connection to a centralized
With visibility into everything that affects wireless and mobility
Mobility Controller. Connectivity and authentication occur
transparently with no complicated logins.
Enabling a unified access framework
service-level agreements (SLAs), AirWave lets you proactively
plan for capacity, visualize client performance and troubleshoot
application issues before you get a helpdesk ticket.
Older access layer networks were not built for the mobility
Flexible and adaptable design
and security requirements of today’s distributed enterprises.
Network design with Aruba is not a one-size-fits-all approach.
Traditionally, networks were built with a focus on Ethernet
ports and physical locations, rather than the user or device
connecting to the network.
Some organizations need pervasive Wi-Fi, while some are
purely wired. Branch offices have different requirements than
corporate headquarters.
Consequently, the addition of secure mobility to such
networks becomes overly complex and costly, often requiring
large-scale equipment upgrades.
And within a corporate campus, some organizations value a
centralized traffic forwarding model where all network traffic
flows to the data center, while other organizations need a
Aruba allows any user, regardless of physical location,
more distributed approach. The incredible flexibility of
whether wired or wireless, to securely access the enterprise
ArubaOS lets it adapt to the unique needs of any organization.
network with an always-on, consistent experience.
Unified Access framework
User connectivity method
• Secure enterprise-grade Wi-Fi
• Wired Ethernet
• VPN remote access
AP connection method
• Private or public IP cloud
-- Ethernet
-- Wireless WAN (EVDO, HSDPA)
• Wi-Fi mesh (point-to-point and point-to-multipoint)
Traffic forwarding
• Centralized – All user traffic flows to a Mobility Controller
• Policy-routed – User traffic is selectively forwarded to a Mobility Controller or bridged locally,
depending on the traffic type and policy
Wi-Fi encryption
• Centralized – Traffic is encrypted between devices and the Mobility Controller
• Distributed – Traffic is encrypted between the device and AP
• Open – No encryption
Integration with existing networks
• Layer 2 and Layer 3 integration – Mobility Controllers can switch or route traffic on a per-VLAN basis
• Rapid Spanning Tree – Enables fast Layer 2 convergence
• OSPF – Simple integration with existing routing topologies
data sheet
ARUBAOS™
Enterprise security framework
ArubaOS uniquely supports AAA FastConnect, which allows
To secure the enterprise network, ArubaOS performs
the encrypted portions of 802.1X authentication exchanges
authentication, access control, and encryption for users
to be terminated on the Mobility Controller, allowing it to
and devices.
federate between different identity stores, including RADIUS
With Aruba’s architecture, authentication is standard and can
be implemented for wired and wireless networks. For wired,
802.1X is the standard for authentication. For wireless, 802.1X
and LDAP. Supporting PEAP-MSCHAPv2, PEAP-GTC, and
EAP-TLS, AAA FastConnect removes the requirement for
external authentication servers to be 802.1X-capable.
is one component of the WPA2 and 802.11i protocols widely
For clients without WPA, VPN or other security software,
recognized as state-of-the-art for Wi-Fi security.
Aruba supports a web-based captive portal that provides
secure browser-based authentication. Captive portal
authentication is encrypted using SSL, and can support both
registered users with a login and password or guest users
who supply only an email address.
Authentication types
• IEEE 802.1X (EAP, LEAP, PEAP, EAP-TLS, EAP-TTLS, EAP-FAST, EAP-SIM, EAP-POTP,
EAP-GTC, EAP-TLV, EAP-AKA, EAP-Experimental, EAP-MD5)
• RFC 2548 Microsoft vendor-specific RADIUS attributes
• RFC 2716 PPP EAP-TLS
• RFC 2865 RADIUS authentication
• RFC 3579 RADIUS support for EAP
• RFC 3580 IEEE 802.1X RADIUS guidelines
• RFC 3748 extensible authentication protocol
• MAC address authentication
• Web-based captive portal authentication
Authentication servers
•
•
•
•
•
Encryption protocols
•
•
•
•
Programmable encryption engine
Permits future encryption standards to be supported through software updates
Web-based captive portal (SSL)
Allows flexibility in authentication methods
Integrated guest access management
Provides secure guest access options
Site-to-site VPN
IPsec tunnel is established between Mobility Controller and IPsec devices. Authentication
support for X.509 PKI, IKEv2, IKE PSK, IKE aggressive mode.
Internal database
LDAP/SSL secure LDAP
RADIUS
TACACS+
Tested authentication server interoperability:
-- Microsoft Active Directory (AD)
-- Microsoft IAS and NPS RADIUS servers
-- Cisco ACS, ISE servers
-- Juniper Steel Belted RADIUS, Unified Access servers
-- RSA ACE/Server
-- Infoblox
-- Interlink RADIUS Server
-- FreeRADIUS
CCMP/AES
WEP 64- and 128-bit
TKIP
SSL and TLS:
-- RC4 128-bit
-- RSA 1024-bit
-- RSA 2048-bit
• L2TP/IPsec (RFC 3193)
• XAUTH/IPsec
• PPTP (RFC 2637)
data sheet
ARUBAOS™
Application-aware mobility firewall
In addition to traditional Layer 4 access technology, PEF
The ArubaOS PEF license enhances user-centric security,
includes AppRF technology. AppRF brings application
application visibility, and control. It brings the power of a
awareness and control to the WLAN. By providing visibility
next-generation mobility firewall to the wireless edge, where
into the types of traffic running on the Wi-Fi network, AppRF
most users traffic first touches the network. It uses DPI to
allows administrators to understand what user traffic is
classify and optimize traffic for over 1,500 apps and gives you
consuming the vital air resource.
full traffic visibility through a simple dashboard.
AppRF also provides unprecedented control over that traffic,
PEF simplifies and enhances access security by adding full identity-
allowing flexible and powerful controls that allow
based security with integrated firewall controls applied on a
administrators to pick which traffic is permitted in the air, by
per-user basis at the wireless edge. This allows ArubaOS to create
which users, and at what priority. AppRF uses a powerful
a security perimeter around each user or device, tightly controlling
concept called Application Categories to enable control over
how that user or device may access enterprise network resources.
entire types of traffic, such as streaming media or social
The VLAN a user is assigned is no longer important – roles
media, with a single command.
are applied to users based on their role. Roles can be derived
in many different ways, based on RADIUS attributes, Active
Directory membership, device type, and many other factors.
Global or role-based policies
Simplicity to control all user traffic with a single command, flexibility to control exactly which
users can run what apps.
Over 1,500 applications
Highly granular visibility and control.
19 application categories
Simplify control over different types of traffic.
Enforce quality-of-service (QoS) tags
Prioritize one application over another
Block unwanted applications
Conserve bandwidth and stop unwanted activities.
Rate limits for applications or
application categories
Permit non-essential traffic while preventing it from overwhelming mission
critical applications.
If the PEF license is not activated, a user or device can be mapped
These URLs are then looked up in a locally-cached database
to a particular VLAN based on the port or wireless SSID. Once the
that contains commonly used and recently accessed web
user has been mapped to a particular VLAN, external firewall
sites. If the user’s site is not on the list, the Mobility Controller
systems or routers can be used to provide basic access controls.
makes a request for the category and reputation of the web
site from the BrightCloud cloud service. This cloud service is
Web Content Policy and Reputation
continuously updated.
Web content is another important part of the security puzzle.
Each web site is classified according to the type of content it
More and more applications are now nothing more than web
sites. And more and more malicious web sites are appearing
on the Internet every day.
serves and the reputation of the web site. Content captures
the spirit of the site, such as news, gambling, adult or social
media. Web Reputation captures the likelihood that a user
Since the web has become an essential yet dangerous place,
visiting the webs ite will be the victim of a malware attack or
we want to be able to quickly determine the type of sites
phishing scam.
users are visiting and gauge the relative threat that these
Webroot web classification metrics:
sites pose to the network and its users.
In order to do that in the most accurate and up-to-date way
possible, ArubaOS includes an optional subscription for web
content visibility, blocking, and rate limiting. The solution
involves extracting the hostnames and URLs that users are
browsing using the Aruba DPI engine.
• 460+ million domains scored and classified
• 83+ categories
• 45+ languages
• 740+ million IP addresses analyzed
• 12+ million dangerous IPs identified
data sheet
ARUBAOS™
Web Content Policy features
Categorize web traffic into 83 categories
Determine how network bandwidth is being used
Block websites by category
Enforce network acceptable use policies
QoS and bandwidth control by category
Reduce network usage of recreational applications
Block websites by reputation
Reduce the opportunity for malware to enter the network
data sheet
ARUBAOS™
AirGroup
ArubaOS integrates proxy mobile IP and proxy DHCP
Mobile devices, smart TVs, video game consoles, and set
functions letting users roam between subnets, ports, APs,
top boxes were all designed primarily to be used in small
and controllers without special client software. This ensures
home networks.
seamless performance even when users wander far afield of
AirGroup technology makes it incredibly easy for these
devices to wirelessly print and share media that leverage
the AP to which they initially connected as they move
throughout the network doing their jobs.
UPnP®, DLNA®, AirPrint™ and AirPlay ® technology. It also
VLAN pooling is another powerful access edge feature that
provides QoS and policy enforcement to control resource
simplifies network design. Instead of pulling VLANs to the
sharing based on group, user, role, time and location.
network edge, they are centralized in the Mobility Controller
Typical use cases that are solved by AirGroup include:
• Enables users to discover network services across IP
subnet boundaries in wireless and wired networks.
• Allows users to access conference room Apple TVs during
presentations using group-based access privileges.
• Identifies AirPrint-enabled printers and enables user
and tunneled to APs.
This has major advantages, including reducing network
configuration complexity and spanning tree diameter. User
membership of VLANs is load-balanced to maintain optimal
network performance as large groups of users move about
the network.
Aruba’s unified access approach also extends the enterprise
access based on location.
• Teachers can project to an Apple TV in a classroom using
a laptop or iPad, while student access is prevented.
• Students get exclusive access to Apple TVs in their dorm
rooms based on personal access privileges, while access
by other residents is not allowed.
to remote locations, over private WANs or using the public
Internet, giving users the same access experience regardless
of location.
To connect users who are away from enterprise network
infrastructure, Mobility Controllers operate as standard VPN
Architected for seamless mobility
Enterprise users increasingly require network access
concentrators, linking remote users through the same access
and security framework as other enterprise users.
while moving from location to location, whether from a
With Aruba, there is no need to build separate access
classroom to a library, a cubicle to a conference room,
networks for each work location – the company’s unified
from headquarters to a branch office, or from the office to a
access approach treats all locations the same.
user’s home.
For Wi-Fi networks, ArubaOS provides seamless connectivity
as users move throughout the network. With roaming
handoff times of 2-3 milliseconds, delay-sensitive and
persistent applications such as voice and video experience
uninterrupted performance.
Fast roaming
• 2-3 msec intra-controller
• 10-15 msec inter-controller
Roaming across subnets and VLANs
Sessions do not drop as clients roam on the network
Proxy mobile IP
Automatically establishes home agent/foreign agent relationship between
Mobility Controllers
Proxy DHCP
Prevents clients from changing IP address when roaming
VLAN pooling
Automatically load balances clients across multiple VLANs
data sheet
ARUBAOS™
Enterprise-grade adaptive WLANs
Once the network is deployed, the Aruba system provides a
Aruba’s ARM technology takes the guesswork out of AP
real-time, color heat map display of the RF environment
deployments. Once APs are brought up, they immediately
showing signal strength, coverage and interference. Through
begin monitoring their local environment for interference,
tight integration with AirWave VisualRF™, WLAN coverage and
noise, and signals being received from other Aruba APs. This
capacity planning can be automated, precluding the need for
includes detection of other APs or Wi-Fi networks and the
frequent and expensive manual site surveys.
channels they are using.
ArubaOS collects aggregate and raw wireless statistics on a
This information is reported back to the controller, which is
per station, per channel and per user basis. Statistics can be
then able to control the optimal channel assignment and
recorded and analyzed through the AirWave management
power levels for each AP in the network – even where
platform, and are also available via SNMP for easy integration
802.11ac has been deployed with mixed VHT20, VHT40 and
with third-party management and analysis applications.
VHT80 channel types.
Live packet capture is available that can turn any Aruba AP or
Users expect high-performance Wi-Fi, even in crowded areas
air monitor into a packet capture device, able to stream
like lecture halls. Advanced ARM features take care of this by
real-time 802.11 frames back to monitoring stations such as
dynamically adapting the infrastructure to ensure optimal
WireShark or WildPackets OmniPeek. With this detailed
network performance in the toughest high-density
information, administrators can quickly troubleshoot user
heterogeneous Wi-Fi client environments.
problems, determine top wireless talkers and diagnose
ARM ensures high performance and multi-media QoS
congested APs.
through techniques such as band steering, which
To protect against unsanctioned wireless devices, Aruba’s
moves dual-band clients out of the crowded 2.4-GHz
rogue AP classification algorithms allow the system to
band, and airtime performance protection, which prevents
accurately differentiate between threatening rogue APs
slower clients from bringing down performance of the
connected to the network and nearby interfering APs.
entire network.
Once classified as rogue, these APs can be automatically
Finally, in areas with dense AP coverage, ARM ensures the
disabled through the wireless and wired network.
optimal use of each channel through automatic channel load
Administrators are also notified of the presence of rogue
balancing and co-channel interference mitigation.
devices, along with their physical location on a floor plan, so
ARM can be used in conjunction with the optional RFProtect
they can be promptly removed from the network.
module spectrum analyzer. While ARM optimizes client
Rogue AP classification and containment is available within
behavior and ensures that APs stay clear of interference, the
base ArubaOS and does not require additional Mobility
spectrum analyzer utilizes Aruba APs to remotely identify and
Controller licensing.
classify Wi-Fi and non-Wi-Fi sources of interference.
For comprehensive wireless intrusion protection, the
Using Aruba APs to scan the spectral composition of
RFProtect module for Mobility Controllers enables protection
2.4-GHz and 5-GHz radio bands, the Aruba RFProtect
against ad hoc networks, man-in-the-middle attacks, denial-
spectrum analyzer remotely identifies RF interference,
of-service (DoS) attacks and many other threats, while
classifies its source and provides real-time analysis at the
enabling wireless intrusion signature detection.
point of the problem.
TotalWatch™, an essential part of the RFProtect WIP
Data collected by the Aruba RFProtect spectrum analyzer is
capability, delivers the industry’s most effective WLAN threat
used to quickly isolate packet transmission problems, ensure
mitigation. It provides visibility into all 802.11 Wi-Fi
over-the-air QoS and mitigate traffic congestion caused by RF
frequencies at 5-MHz increments, including in between
contention with other devices operating in the same band or
channels, monitors the 4.9-GHz frequency band and
channel. Appropriate remediation measures can then be put
automatically adapts wireless security scanning intervals on
in place to optimize network performance.
APs based on data availability.
data sheet
ARUBAOS™
Tar-pit containment is another vital RFProtect WIP feature.
With Aruba’s real-time location tracking (RTLS), devices are
With tar pit containment, Aruba APs respond to probe
simultaneously and continuously located and tracked. Device
requests from rogue devices with fake BSSIDs or channels.
location can be displayed on building floor plans through the
The rogue device then associates with that fake info and fails
AirWave management platform or linked to outside systems
to push any traffic. User interaction is then required to get
through a simple API.
the rogue device connected again.
The Aruba Analytics and Location Engine (ALE) also
ArubaOS includes advanced location visualization and
continuously collects proximity information and keeps a
tracking of 802.11 devices. RF signature-based location
real-time database of the location of all devices on the
triangulation allows administrators to physically locate any
network. This is extremely useful for indoor wayfinding and
802.11 user or device within one meter of accuracy.
retail analytics applications.
Adaptive Radio Management (ARM)
Automatically manages all RF parameters to achieve maximum performance.
802.11ac VHT20, VHT40 and VHT80 support
Manages spectrum for all 802.11ac networks.
802.11n HT20 and HT40 support
Manages spectrum for all 802.11n networks.
Client band steering
Keeps dual-band clients on optimal RF band.
Self-healing around failed APs
Automatically adjusts power levels to compensate for failed APs.
Airtime fairness
Manages client access to the air resources. Can be configured to provide fair access or to
deliver preferred access to clients that connect using the latest 802.11 standard.
RF spectrum load-balancing
Evenly distributes clients across available channels.
Single-channel coordinated access
Ensures optimal performance even with nearby APs on the same channel.
RF planning
Automatic predeployment modeling, planning and placement of APs and RF monitors
based on capacity, coverage and security requirements.
Coverage hole and interference detection
Detects clients that cannot associate due to coverage gaps.
Timer-based AP access control
Shuts off APs outside of defined operating hours.
Remote wireless packet capture
Remotely captures raw 802.11 frames and streams to protocol analyzer.
Plug-ins for third-party analysis tools
Wireshark, OmniPeek, AirMagnet.
Rogue AP detection and containment
Detects unauthorized APs and automatically shuts them down.
Real-time location tracking and monitoring
Enhanced with optional Aruba ALE solution.
Location tracking API for external integration
Compatible with many retail analytics solutions.
data sheet
ARUBAOS™
High availability
Today, modern Wi-Fi networks are more essential to businesses than traditional wired Ethernet networks. Therefore,
ArubaOS has a robust set of high-availability capabilities designed to minimize downtime in the unlikely event of a Mobility
Controller failure.
Deployment modes
Active/Active (1:1)
Each Mobility Controller typically serves 50% of its rated capacity. The first acts as a standby
for APs served by second controller and vice-versa. If a controller fails, its APs failover to the
other controller, ensuring high-availability to all APs.
Active/Standby (1+1)
One Mobility Controller terminates all the APs, while the other controller acts as a standby.
If the primary controller goes down, APs move to standby controller.
N+1
Multiple active Mobility Controllers are backed-up by single standby controller.
Feature
Benefit
AP establish simultaneous communication
channel with both active and standby
Mobility Controller.
Instantaneous failover to redundant Mobility Controller when first fails.
During a failover, the APs do not turn their
radios off and on.
SSID always available.
The solution works across Layer 3 networks
No special topologies needed.
Client state sync
Credentials are cached, eliminating need to reauthenticate and overload RADIUS server.
N+1 oversubscription
Simplifies configuration and reduces number of Mobility Controllers needed.
data sheet
ARUBAOS™
Remote networking for branch offices
and teleworkers
Whether supporting branch offices of one or one hundred
Aruba remote networking solutions provide a simple, secure,
compromises. As the head-end component of the remote
and cost-effective way to extend the corporate network to
networking solution, data center-based Mobility Controllers
branch offices, clinics, SOHOs, stores and telecommuters.
handle all complex configuration, management, software
Traditional remote networking solutions replicate routing,
switching, firewall, and other services at each remote
users, Aruba delivers full-service networking without
updates, authentication, intrusion detection, and remote site
termination tasks.
location. Managing and controlling user access to network
Branch office network services are virtualized in the data
services, applications, and resources requires proliferating
center controllers and then extended over any public or
ports, subnets, and VLANs – effectively creating multiple
private IP network to affordable Remote Access Points (RAPs)
networks at each site. This is costly and complex to deploy
that provide secure connectivity and services to end users.
and maintain.
Zero-touch provisioning
Administrators can deploy RAPs without any preconfiguration. Simply ship it to the
end user.
Wired and wireless
Users connect to RAPs via wired Ethernet, Wi-Fi or both.
Flexible authentication
802.1X, captive portal, MAC address authentication per-port and per-user.
Centralized management
No local configuration is performed on APs – Configuration and management are done by
the Mobility Controller.
3G/4G LTE WAN connection
RAPs support USB wireless WAN adapters (EV-DO, HSDPA) for primary or backup
Internet connectivity.
FlexForward traffic forwarding
• Centralized – all user traffic flows to a Mobility Controller.
• Locally bridged – All user traffic bridged by access device to local LAN segment.
• Policy-routed – User traffic selectively forwarded to Mobility Controller or bridged locally,
depending on traffic type/policy (requires PEF license).
Enterprise-grade security
RAPs authenticate to Mobility Controllers using X.509 certificates and then establish secure
IPsec tunnels.
Uplink bandwidth reservation
Defines reserved bandwidth for loss-sensitive application protocols such as voice.
Local diagnostics
In the event of a call to the help desk, local users can browse to a predefined URL to access
full RAP diagnostics.
Remote mesh portal
A RAP may also act as a mesh portal, providing wireless links to downstream APs.
Supported APs
RAP-3, RAP-100 series, RAP-155, AP-105, AP-220 series, AP-130 series, AP-110 series,
AP-100 series, AP-90 series, AP-175 series
Minimum required link speed
64 kbps per SSID
Encryption protocol (RAP to Mobility Controller)
AES-CBC-256 (inside IPsec ESP)
data sheet
ARUBAOS™
REMOTE NETWORKING FOR BRANCH OFFICES AND TELEWORKERS
BRANCH OFFICE/ TELECOMMUTER
ENTERPRISE DATACENTER
INTERNET SERVICES
BRANCH OFFICE
BRANCH OFFICE
INTERNET EXIT POINT
PRINTER
SERVER
DESKTOP
ACCESS SWITCH
FIREWALL
REMOTE AP (RAP)
MOBILITY CONTROLLER
LAPTOP
SMARTPHONE
VOICE
KEY
OFFICE/LOCAL NETWORK
VOICE NETWORK
ENTERPRISE NETWORK
figure 2.8_071614
Aruba RAPs provide secure mobile connectivity to branch and home offices.
data sheet
ARUBAOS™
Simple, secure connectivity for
traveling professionals
ArubaOS is compatible with several popular VPN clients and
Users who need access to enterprise resources while away
also provides the optional VIA client, which can be installed
from the office typically rely on VPN client software, which
on Android, iOS, Mac OS X and Windows devices.
connects to a VPN concentrator located in an enterprise DMZ.
By merging access networks together, policy and access
With Aruba, remote VPN users are treated like any other user.
configuration is unified, the user experience is improved,
They leverage the same access policies and service
helpdesk calls are reduced, and IT expenses are lowered.
the VPN clients built into major client operating systems. It
definitions used at headquarters or a branch office RAP
deployment. Mobility Controllers act as VPN concentrators,
eliminating the need for a parallel access infrastructure.
Tested client support
• Aruba VIA client on Windows
• Cisco and Nortel VPN clients
• OpenVPN, Apple/Windows native client
VPN protocols
• L2TP/IPsec (RFC 3193)
• XAUTH/IPsec
• PPTP (RFC 2637)
Authentication
•
•
•
•
•
Username/password
X.509 PKI
RSA SecurID
Smart Card
Multi-factor
Secure enterprise mesh
Through cooperative control technology, Aruba uses an
The Aruba secure enterprise mesh solution provides a
intelligent link management algorithm to optimize traffic
flexible, wire-free design allowing APs to be placed wherever
paths and links.
they are needed – indoors and outdoors. The absence of
Mesh APs communicate with their neighbors and advertise a
fiber or cable runs significantly reduces network installation
costs and requires fewer Ethernet ports.
number of RF and link attributes – such as link cost, path
cost, node cost, loading – that allow them to make intelligent
The solution fully integrates with the Aruba unified access
selection of the best path to take for the application.
framework, enabling a single, enterprise-wide network
Mesh paths and links automatically adjust in the event of
wherever users roam. The secure enterprise mesh is based
on programmable software and does not require specialized
hardware; any Aruba indoor or ruggedized outdoor 802.11n
AP can function as a mesh AP.
The secure enterprise mesh can support all enterprise
wireless needs including Wi-Fi access, concurrent wireless
intrusion protection, wireless backhaul, LAN bridging,
and point-to-multipoint connectivity, all with a single
common infrastructure.
This is an excellent solution for connectivity applications,
including inter-building connectivity, outdoor campus
mobility, wire-free offices, and wire-line back-up; security
applications, such as video and audio monitoring, alarms
and duress signals, and industrial applications and
sensor networks.
high-loads or interference. Further, application tags for voice
and video traffic are shared to ensure latency sensitive traffic
is prioritized over data.
The cooperative control technology also provides self-healing
functionality for the mesh network in the event of a blocked
path or AP failure.
data sheet
ARUBAOS™
SECURE ENTERPRISE MESH
MESH
POINT
ROOT
MESH
MESH
POINT
PORTAL
MESH
POINT
MOBILITY CONTROLLER
REDUNDANT
MESH
MESH
POINT
PORTAL
MESH
POINT
KEY
WLAN RF COVERAGE
MESH PATH
MESH RF COVERAGE
MESH LINK
figure 2.9_071614
Broad application support
Wi-Fi access, concurrent wireless intrusion protection, wireless backhaul, LAN bridging, and
point-to-multipoint connectivity.
Unified network access
Integrates mesh networks with campus and branch office WLANs. Users roam seamlessly
between campus and branch Wi-Fi and mesh networks.
Cooperative control
Intelligent RF link management determines optimal performance path and allows the
network to self-organize.
Self-healing
Resilient self-healing mesh overcomes a broken path or AP failure.
Mesh clustering
Supports scalability by allowing a large mesh to be segmented into highly-available clusters.
Centralized encryption
Data encrypted end-to-end, from client to core, protecting the network even if a mesh AP
is stolen.
Centralized management
All mesh nodes are configured and controlled centrally by Mobility Controllers. No local
management is required.
Extensive graphical support tools
Full network visualization includes coverage heat maps, automatic link budget calculation,
floor plans, and maps with network topology.
Standards-based design
Secure enterprise mesh based on design principles from IEEE 802.11s.
data sheet
ARUBAOS™
Management, configuration and
troubleshooting
All APs and Mobility Controllers, even those distributed in
Mobility Controller configuration, management, and
managed from a single console. To ease configuration of
troubleshooting are provided through a browser-based GUI
common tasks, intuitive task-based wizards guide the
and a command line interface that will be familiar to any
network administrator through every step of the process.
network administrator.
Mobility Controllers can be deployed in 1:1 and 1:n VRRP-
ArubaOS also integrates with AirWave, which eases management
based redundant configurations with redundant data center
during all stages of the WLAN lifecycle – from planning and
support. When deployed in Layer 3 topologies, the OSPF
deploying to monitoring, analyzing and troubleshooting. AirWave
routing protocol enables automatic route learning and route
also provides long-term trending and analysis, helpdesk
distribution for fast convergence.
branch or regional offices, can be centrally configured and
integration tools, and customizable reporting.
Web-based configuration
Allows any administrator with a standard web browser to manage the system.
Command line
Console and SSH
Syslog
Supports multiple servers, multiple levels, and multiple facilities
SNMP v2c
Yes
SNMP v3
Enhances standard SNMP with cryptographic security.
Centralized configuration of Mobility Controllers
A designated master Mobility Controller can configure and manage several downstream
local controllers.
VRRP
Supports high availability between multiple Mobility Controllers.
Redundant data center support
Yes – access devices can be configured with IP addresses for backup controllers.
OSPF
Yes – stub mode support for learning default route or injecting local routes into an
upstream router.
Rapid spanning tree protocol
Yes – provides fast Layer 2 convergence.
ArubaOS support for IPv6
ArubaOS facilitates the deployment of Mobility Controllers
With the depletion of available IPv4 addresses, organizations
and APs in today’s IPv6 and dual-stack environments. Nearly
are now planning for or have already begun deployments of
all functions with the exception of IPsec can be deployed in
IPv6 within their networks.
native IPv6 mode. Every aspect of management, monitoring,
While IPv4 and IPv6 both define how data is transmitted over
networks, IPv6 adds a much larger address space than IPv4
and firewalling are fully IPv6-aware.
ArubaOS also has a built-in IPv6 DHCP server.
and can support billions of unique IP addresses.
As organizations transition from IPv4 to IPv6, network equipment
must support dual-stack interoperability of IPv6 within an IPv4
network or full deployments within a pure IPv6 environment.
Management over IPv6
GRE, SSH, Telnet, SCP, Web UI, FTP,TFTP, Syslog, SNMP
IPv6 DHCP server
Yes
Captive portal over IPv6
Yes
Support IPv6 VLAN interface address on Mobility Controller
Yes
Support AP-Mobility Controller communication over IPv6
Yes
USGv6 certified firewall
Yes
data sheet
ARUBAOS™
Context-aware controls
These voice-related features can include commands like
Support for 802.11e and Wi-Fi Multimedia (WMM) ensures
postpone ARM scanning for the duration of a call and
wireless QoS for delay-sensitive applications with mapping
prioritize roaming for clients that are engaged in an active
between WMM tags and internal hardware queues.
call. This is critical to enabling the large-scale deployment of
Mobility Controllers enable mapping of 802.1p and IP DiffServ
enterprise voice communications over Wi-Fi.
tags to hardware queues for wired-side QoS and can be
Additionally, ArubaOS now includes device fingerprinting
instructed to apply certain 802.1p and IP DiffServ tags to
technology, allowing network administrators to assign
different applications on demand.
network policies on device types in addition to applications
With the addition of the Aruba PEF module, voice-over-IP
protocols – including Lync, session initiation protocol (SIP),
Spectralink Voice Priority (SVP), Alcatel New Office
and users. Device fingerprinting delivers greater control over
which devices are allowed to access the network and how
these devices can be used.
Environment (NOE), Vocera and skinny call control protocol
ArubaOS can accurately identify and classify mobile devices
(SCCP) – are followed within the Aruba Mobility Controller.
such as the Apple iPad, iPhone, or iPod as well as devices
Aruba’s application fingerprinting technology enables
running the Android or BlackBerry operating systems. This
Mobility Controllers to follow encrypted signaling protocols.
information can be shared with AirWave for enhanced
Once these streams are identified, Aruba WLANs prioritize
them for delivery on the wireless channel and trigger
network visibility for all network users, regardless of location
or mobile device.
voice-related features.
T-SPEC/TCLAS
Yes
WMM
Yes
WMM priority mapping
Yes
U-APSD (Unscheduled Automatic Power-Save Delivery)
Yes
IGMP snooping for efficient multicast delivery
Yes
Application and device fingerprinting
Yes
CERTIFICATIONS
• Wi-Fi Alliance certified (802.11a/b/g/n/d/h/ac, WPA™
STANDARDS SUPPORTED
General switching and routing
Personal, WPA™ Enterprise, WPA2™ Personal, WPA2™
• RFC 1812 Requirements for IP Version 4 Routers
Enterprise, WMM™, WMM Power Save)
• RFC 1519 CIDR
• FIPS 140-2 validated (when operated in FIPS mode)
• RFC 1256 IPv4 ICMP Router Discovery (IRDP)
• Common Criteria EAL-2
• RFC 1122 Host Requirements
• RSA certified
• RFC 768 UDP
• Polycom/Spectralink VIEW certified
• RFC 791 IP
• USGv6 firewall
• RFC 792 ICMP
• RFC 793 TCP
• RFC 826 ARP
• RFC 894 IP over Ethernet
• RFC 1027 Proxy ARP
• RFC 2236 IGMPv2
• RFC 2328 OSPFv2
data sheet
ARUBAOS™
• RFC 2338 VRRP
• RFC 2460 Internet Protocol version 6 (IPv6)
• RFC 2578 Structure of Management Information
Version 2 (SMIv2)
• RFC 2516 Point-to-Point Protocol over Ethernet (PPPoE)
• RFC 2579 Textual Conventions for SMIv2
• RFC 3220 IP Mobility Support for IPv4 (partial support)
• RFC 2863 The Interfaces Group MIB
• RFC 4541 IGMP and MLD Snooping
• RFC 3418 Management Information Base (MIB) for the
• IEEE 802.1D-2004 – MAC Bridges
Simple Network Management Protocol (SNMP)
• IEEE 802.1Q – 1998 Virtual Bridged Local Area Networks
• RFC 959 File Transfer Protocol (FTP)
• IEEE 802.1w – Rapid Spanning Tree Protocol
• RFC 2660 Secure HyperText Transfer Protocol (HTTPS)
QoS and policies
• IEEE 802.1D – 2004 (802.1p) Packet Priority
• IEEE 802.11e – QoS Enhancements
• RFC 2474 Differentiated Services
Wireless
• IEEE 802.11a/b/g/ac 5 GHz, 2.4 GHz
• IEEE 802.11d Additional Regulatory Domains
• IEEE 802.11e QoS
• IEEE 802.11h Spectrum and TX Power Extensions for
5 GHz in Europe
• IEEE 802.11i MAC Security Enhancements
• IEEE 802.11k Radio Resource Management
• IEEE 802.11ac Enhancements for Very High Throughput
• IEEE 802.11n Enhancements for Higher Throughput
• IEEE 802.11v Wireless Network Management
(partial support)
Management and traffic analysis
• RFC 2030 SNTP, Simple Network Time Protocol v4
• RFC 854 Telnet client and server
• RFC 783 TFTP Protocol (Revision 2)
• RFC 951,1542 BootP
• RFC 2131 Dynamic Host Configuration Protocol
• RFC 1591 DNS (client operation)
• RFC 1155 Structure of Management Information (SMIv1)
• RFC 1157 SNMPv1
• RFC 1212 Concise MIB definitions.
• RFC 1213 Management Information Base for Network
Management of TCP/IP-based internets - MIB-II
• RFC 1215 Convention for defining traps for use with
the SNMP
• RFC 1286 Bridge MIB
• RFC 3414 User-based Security Model (USM) for v.3 of the
Simple Network Management
• RFC 1573 Evolution of Interface
• RFC 2011 SNMPv2 Management Information Base for the
Internet Protocol using SMIv2
• RFC 2012 SNMPv2 Management Information
• RFC 2013 SNMPv2 Management Information
• RFC 1901 1908 SNMP v2c SMIv2 and Revised MIB-II
• RFC 2570, 2575 SNMPv3 user based security, encryption
and authentication
• RFC 2576 Coexistence between SNMP Version 1,
Version 2 and Version 3
• RFC 2233 Interface MIB
• RFC 2251 Lightweight Directory Access Protocol (v3)
• RFC 1492 An Access Control Protocol, TACACS+
• RFC 2865 Remote Access Dial In User Service (RADIUS)
• RFC 2866 RADIUS Accounting
• RFC 2869 RADIUS Extensions
• RFC 3576 Dynamic Authorization Extensions to
remote RADIUS
• RFC 3579 RADUIS Support For Extensible Authentication
Protocol (EAP)
• RFC 3580 IEEE 802.1X Remote Authentication Dial In User
Service (RADIUS)
• RFC 2548 Microsoft RADUIS Attributes
• RFC 1350 The TFTP Protocol (Revision 2)
• RFC 3164 BSD System Logging Protocol (syslog)
• RFC 2819 Remote Network Monitoring (RMON) MIB
Security and encryption
• IEEE 802.1X Port-Based Network Access Control
• RFC 1661 The Point-to-Point Protocol (PPP)
• RFC 2406 IP Encapsulating Security Payload (ESP)
• RFC 2661 Layer Two Tunneling Protocol “L2TP”
• RFC 3193 Securing L2TP using IPsec
• RFC 2451 The ESP CBC-Mode Cipher Algorithms
• RFC 2403 The Use of HMAC-MD5-96 within ESP and AH
• RFC 2401 Security Architecture for the Internet Protocol
• RFC 2404 The Use of HMAC-SHA-1-96 within ESP and AH
• RFC 2408 Internet Security Association and Key
Management Protocol (ISAKMP)
• RFC 2409 The Internet Key Exchange (IKE)
• RFC 2405 ESP DES-CBC cipher algorithm with explicit IV
• RFC 2403 Use of HMAC-SHA1-96 with ESP and AH
• RFC 3602 The AES-CBC Cipher Algorithm and Its Use
with IPsec
data sheet
ARUBAOS™
• RFC 4017 Extensible Authentication Protocol (EAP)
Method Requirements for Wireless LANs
• RFC 3706 A Traffic-Based Method of Detecting Dead
Internet Key Exchange (IKE) Peers
• RFC 3748, 5247 Extensible Authentication Protocol (EAP)
• RFC 3079 Deriving Keys for use with Microsoft
Point-to-Point Encryption (MPPE)
• RFC 4137 State Machines for Extensible Authentication
Protocol (EAP) Peer and Authenticator
• RFC 2716 PPP EAP TLS Authentication Protocol
• RFC 2246 The TLS Protocol (SSL)
• RFC 2407 Internet IP Security Domain of Interpretation
for ISAKMP
• RFC 3948 UDP encapsulation of IPsec packets
• RFC 4793 EAP-POTP
• Internet Draft – draft-ietf-ipsec-nat-t-ike-00
• Internet Draft – draft-ietf-ipsec-nat-t-ike-01
• Internet Draft – draft-ietf-ipsec-nat-t-ike-02
• Internet Draft – EAP-TTLS
• Internet Draft – EAP-PEAPv0
• Internet Draft – XAuth for ISAKMP
1344 Crossman Ave | Sunnyvale, CA 94089
1.866.55.ARUBA | T: 1.408.227.4500 | FAX: 1.408.227.4550 | [email protected]
www.arubanetworks.com
2014 Aruba Networks, Inc. Aruba Networks®, Aruba The Mobile Edge Company® (stylized), Aruba Mobilty Management System®, People Move. Networks Must
©
Follow.®, Mobile Edge Architecture®, RFProtect®, Green Island®, ETIPS®, ClientMatch®, Bluescanner™ and The All Wireless Workspace Is Open For Business™ are all
Marks of Aruba Networks, Inc. in the United States and certain other countries. The preceding list may not necessarily be complete and the absence of any mark from
this list does not mean that it is not an Aruba Networks, Inc. mark. All rights reserved. Aruba Networks, Inc. reserves the right to change, modify, transfer, or otherwise
revise this publication and the product specifications without notice. While Aruba Networks, Inc. uses commercially reasonable efforts to ensure the accuracy of the
specifications contained in this document, Aruba Networks, Inc. will assume no responsibility for any errors or omissions. DS_ArubaOS_082014